This Feb. 24, 2021 photo shows a T-Mobile store at a shopping mall in Pittsburgh. T-Mobile says about 7.8 million of its current postpaid customer accounts’ information and approximately 40 million records of former or prospective customers who had previously applied for credit with the company were involved in a recent data breach. T-Mobile said Wednesday, Aug. 18, that customers’ first and last names, date of birth, Social Security numbers, and driver’s license/ID information were exposed. (AP Photo/Keith Srakocic)

 

BELLEVUE, Wash. (AP) — T-Mobile says it has notified nearly all of the millions of customers whose personal data was stolen and that it is “truly sorry” for the breach.

CEO Mike Sievert said in a written statement Friday that the company spends lots of effort to try to stay ahead of criminal hackers “but we didn’t live up to the expectations we have for ourselves to protect our customers. Knowing that we failed to prevent this exposure is one of the hardest parts of this event.”

The company disclosed earlier in August that the names, Social Security numbers and information from driver’s licenses or other identification of just over 40 million people who applied for T-Mobile credit were exposed in a recent data breach. The same data for about 7.8 million current T-Mobile customers who pay monthly for phone service also appeared to be compromised.

Sievert’s statement follows a Thursday report in the Wall Street Journal in which John Binns, a 21-year-old American hacker living in Turkey, told the newspaper he was responsible for the hack and blamed T-Mobile’s lax security for making it possible.

Sievert made no direct reference to Binns on Friday but said that, “in short, this individual’s intent was to break in and steal data, and they succeeded.”

Sievert said the breach has been contained, the investigation is “substantially complete” and that customer financial information wasn’t exposed. He said T-Mobile hired cybersecurity experts from Mandiant to help with the investigation and is coordinating with law enforcement.

“What we can share is that, in simplest terms, the bad actor leveraged their knowledge of technical systems, along with specialized tools and capabilities, to gain access to our testing environments and then used brute force attacks and other methods to make their way into other IT servers that included customer data,” Sievert wrote.

Sievert said the company has notified “just about every” current customer who was affected, and is now doing the same for former customers and prospective customers who might have supplied some personal information in applying for an account. Unaffected customers will see a banner on their T-Mobile online account page letting them know their data was not exposed.

T-Mobile, which is based in Bellevue, Washington, became one of the country’s largest cellphone service carriers, along with AT&T and Verizon, after buying rival Sprint last year. It reported having a total of 102.1 million U.S. customers after the merger.

T-Mobile has previously disclosed a number of data breaches over the years, though the most recent was the largest. Sievert said the company is taking steps to improve its security.

Copyright 2021 The Associated Press. All rights reserved